DEA-C01 Data Security and Governance Practice Test 21 — 15 Questions

Question 1

A data engineer needs to grant an IAM user read-only access to an S3 bucket named 'data-lake'. Which IAM policy statement should be used?

Accepted Answer

{"Effect":"Allow","Action":["s3:ListBucket","s3:GetObject"],"Resource":["arn:aws:s3:::data-lake","arn:aws:s3:::data-lake/*"]}. It allows ListBucket on the bucket and GetObject on objects, enabling read-only access. Option A is wrong because it grants write actions (PutObject, DeleteObject). Option B is wrong because it allows all S3 actions (s3:*). Option D is wrong because it only allows ListBucket, not GetObject.

Answer

{"Effect":"Allow","Action":["s3:PutObject","s3:DeleteObject"],"Resource":"arn:aws:s3:::data-lake/*"}

Answer

{"Effect":"Allow","Action":"s3:*","Resource":"*"}

Answer

{"Effect":"Allow","Action":"s3:ListBucket","Resource":"arn:aws:s3:::data-lake"}

Question 2

A company needs to ensure that data stored in Amazon RDS is encrypted at rest. Which action should the data engineer take?

Accepted Answer

Create a new RDS instance with encryption enabled using AWS KMS.. Amazon RDS encryption at rest must be enabled when the DB instance is created, using AWS KMS. It cannot be added later. Option A is incorrect because encryption cannot be enabled on an existing RDS instance; you must create a new one with encryption enabled. Option B is incorrect because encrypting the underlying EBS volumes does not encrypt the RDS database; RDS encryption at rest is separate and must be configured at the instance level. Option D is incorrect because SSL/TLS secures data in transit, not at rest.

Answer

Enable encryption at rest by modifying the existing RDS instance.

Answer

Encrypt the underlying EBS volumes using AWS KMS.

Answer

Enable SSL/TLS for connections to the RDS instance.

Question 3

A financial services company needs to share sensitive customer data with a third-party analytics firm. The data resides in an S3 bucket encrypted with an AWS KMS customer managed key. The third party has their own AWS account. Which combination of steps is required to securely share the data? (Choose TWO.)

Accepted Answer

Update the KMS key policy to include the third-party account as a principal with kms:Decrypt permission. Option B is correct because when an S3 object is encrypted with a customer managed KMS key, any principal in another AWS account must be explicitly granted kms:Decrypt on that key via the key policy (or a grant); the key policy is the primary cross-account authorization mechanism for KMS keys. Option E is correct because the third-party account also needs S3-level permission to read the objects, which is provided by a bucket policy granting actions such as s3:GetObject to the third-party principal. Together, the bucket policy authorizes the S3 data access and the KMS key policy authorizes decryption of the objects. Option A is wrong because KMS key material is never exported or shared; the third party uses the key through KMS APIs without ever seeing the material. Option C is wrong because creating a role in the third-party account assumable by the data owner reverses the trust direction and does not grant the third party access to the data. Option D is wrong because key management (e.g., kms:CreateGrant, kms:PutKeyPolicy) is not needed and would over-privilege the third party; only kms:Decrypt is required.

Answer

Share the KMS key material with the third party

Answer

Create an IAM role in the third-party account that can be assumed by the data owner

Answer

Grant the third-party account access to the KMS key management

Question 4

A company is designing a data lake on AWS and must comply with GDPR requirements. The company needs to implement data masking for personally identifiable information (PII) columns in Amazon Redshift. Which feature should be used?

Accepted Answer

Create views in Redshift that apply masking functions. Amazon Redshift supports dynamic data masking through views that apply masking functions, such as using CASE statements or custom masking functions to obfuscate PII columns. Option A is incorrect because Amazon RDS Proxy is a connection proxy for RDS databases and does not provide data masking capabilities for Redshift. Option B is incorrect because Amazon S3 Object Lambda is used to transform data in S3, not to mask data in Redshift queries. Option D is incorrect because AWS Lake Formation row-level security filters rows based on permissions but does not mask or obfuscate column values; it is for access control, not data masking.

Answer

Use Amazon RDS Proxy to intercept queries

Answer

Amazon S3 Object Lambda to mask data on the fly

Answer

AWS Lake Formation row-level security

Question 5

A company wants to centrally manage encryption keys for multiple AWS services and automatically rotate them every year. Which AWS service should be used?

Accepted Answer

AWS Key Management Service (KMS). AWS Key Management Service (KMS) is designed to centrally manage encryption keys for multiple AWS services and supports automatic annual rotation of customer master keys. It integrates with services like S3, EBS, and RDS, making it the correct choice.

Answer

AWS CloudHSM

Answer

AWS Certificate Manager (ACM)

Answer

AWS Secrets Manager

Question 6

A data engineer needs to ensure that an Amazon Redshift cluster encrypts all data at rest. Which setting must be enabled when creating the cluster?

Accepted Answer

Enable encryption. Amazon Redshift encryption at rest is enabled during cluster creation by selecting the encryption option. Option A is incorrect because enabling automated snapshots is for backup and recovery, not encryption. Option C is incorrect because SSL/TLS ensures encryption in transit, not at rest. Option D is incorrect because VPC is for network isolation, not encryption.

Answer

Enable automated snapshots

Answer

Enable SSL/TLS

Answer

Enable VPC

Question 7

A company uses Amazon RDS for PostgreSQL with encryption at rest using AWS KMS. The company needs to share a database snapshot with a different AWS account. What must be done to allow the target account to restore the snapshot?

Accepted Answer

Share the snapshot and update the KMS key policy to allow the target account to use the key. Cross-account snapshot sharing of an encrypted snapshot requires both sharing the snapshot and granting the target account permission to use the KMS key via the key policy. Option A is incorrect because copying does not grant the necessary key access. Option B is incorrect because IAM roles are not used for this purpose; KMS key policies are the mechanism for cross-account access. Option D is incorrect because encryption cannot be disabled on an existing encrypted snapshot.

Answer

Copy the snapshot to the target account's region and share it

Answer

Create an IAM role in the source account that allows cross-account snapshot access

Answer

Disable encryption on the snapshot before sharing

Question 8

A data engineer needs to restrict access to an S3 bucket so that only users from a specific AWS account can read objects. Which S3 bucket policy element should be used?

Accepted Answer

Principal. The Principal element in an S3 bucket policy specifies the AWS account, user, or role that the policy applies to. By setting the Principal to a specific AWS account ID, only users from that account can read objects. Option A is wrong because the Action element specifies the allowed or denied operations (e.g., s3:GetObject), not the account. Option C is wrong because the Resource element identifies the bucket or objects, not the requester. Option D is wrong because the Condition element adds additional constraints (e.g., IP address), but it is not the primary element for specifying the allowed account; Principal is the correct element for that purpose.

Answer

Action

Answer

Resource

Answer

Condition

Question 9

A company uses Amazon Kinesis Data Streams to ingest real-time data. The compliance team requires that all data in the stream be encrypted at rest. Which configuration should be enabled?

Accepted Answer

Enable server-side encryption using an AWS KMS key. Server-side encryption (SSE) for Amazon Kinesis Data Streams uses an AWS KMS key to automatically encrypt data at rest as it is written to the stream and decrypt it when read. This meets the compliance requirement for encryption at rest without requiring any changes to the producer or consumer applications.

Answer

Enable TLS encryption on the Kinesis stream

Answer

Use client-side encryption in the producer application

Answer

Store the data in Amazon CloudWatch Logs instead

Question 10

A company needs to automate the detection of sensitive data in Amazon S3 and generate reports. Which AWS service should be used?

Accepted Answer

Amazon Macie. Amazon Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to discover and protect sensitive data in Amazon S3. It automatically detects personally identifiable information (PII), financial data, and credentials, and generates detailed findings and reports. This directly matches the requirement to automate sensitive data detection and reporting in S3.

Answer

Amazon Inspector

Answer

Amazon GuardDuty

Answer

AWS Config

Question 11

A data engineer needs to ensure that an Amazon Redshift cluster only accepts encrypted connections. Which parameter should be modified?

Accepted Answer

require_SSL. Setting the `require_SSL` parameter to `true` forces all connections to the Amazon Redshift cluster to use SSL/TLS encryption, ensuring that data in transit is encrypted. This parameter is modified in the cluster's parameter group and applies to both JDBC and ODBC connections, as well as the Redshift Query Editor.

Answer

enable_user_activity_logging

Answer

max_concurrency_scaling_clusters

Answer

wlm_json_configuration

Question 12

A data engineer needs to store encryption keys used for protecting data in Amazon S3 and automatically rotate them every year. Which service should be used?

Accepted Answer

AWS KMS. AWS KMS is the managed service for creating, storing, and rotating encryption keys, and it supports automatic annual rotation for customer managed keys. It integrates natively with S3 SSE-KMS, making it the correct choice for key storage and yearly rotation.

Answer

AWS CloudHSM

Answer

AWS Certificate Manager

Answer

AWS Secrets Manager

Question 13

A data engineer needs to ensure that an Amazon S3 bucket containing sensitive customer data is encrypted at rest. Which AWS service can be used to manage the encryption keys?

Accepted Answer

AWS Key Management Service (KMS). AWS Key Management Service (KMS) is the managed service for creating, rotating, and controlling the keys used to encrypt data at rest in S3 (SSE-KMS). It integrates natively with S3 so that objects are encrypted with a KMS customer master key, and access to the key is governed by IAM and key policies. This is the standard answer for managing S3 encryption keys.

Answer

AWS Certificate Manager

Answer

AWS Secrets Manager

Answer

AWS CloudHSM

Question 14

A company stores sensitive data in an Amazon S3 bucket. To comply with regulations, all data must be encrypted at rest using server-side encryption. The security team wants to ensure that any attempt to upload an unencrypted object is automatically denied. Which S3 bucket policy condition should be used?

Accepted Answer

s3:x-amz-server-side-encryption. The bucket policy condition key s3:x-amz-server-side-encryption matches the x-amz-server-side-encryption request header that S3 requires on PUT requests when server-side encryption is specified. By using a Deny effect with a StringNotEquals condition on this key (or Null check), any PutObject request that does not include the encryption header is rejected before the object is written. This enforces encryption at rest at the API layer, regardless of client behavior.

Answer

s3:x-amz-server-side-encryption-aws-kms-key-id

Answer

s3:x-amz-acl

Answer

s3:x-amz-storage-class

Question 15

A company uses AWS Glue to process data from Amazon S3. The data contains personally identifiable information (PII). The data engineer needs to automatically detect and mask PII fields before the data is loaded into Amazon Redshift. Which combination of AWS services should be used?

Accepted Answer

Amazon Macie and AWS Glue. Amazon Macie uses machine learning to automatically discover and classify PII in S3 data, and AWS Glue can then apply transforms (e.g., via a Glue ETL job or Glue Studio) to mask or redact those fields before loading into Redshift. Macie identifies sensitive data locations, and Glue performs the masking during the ETL pipeline, satisfying the requirement to detect and mask PII automatically.

Answer

Amazon CloudWatch Logs and AWS Lambda

Answer

Amazon S3 Object Lambda and AWS Glue

Answer

AWS IAM Access Analyzer and AWS Glue